RE: [cobalt-users] [RAQ 4] [Neomail] [open relay]

["Phil Beynon" <Infolink@xxxxxxxxxxxxxxx>]

> On Thu, 16 May 2002 10:33:53 -0500, Jay Summers wrote:
> >>> Maybe FormMail ?
> >>
> >> wouldnt i have to have root privalages to open up the relay?
> >> .pkgs are the only thing i have installed as admin/root
> >
> >No. I think Gerald was suggesting one of your customers might be
> >using Matt
> >Wrights FormMail script which is very easy to exploit and send tons
> >of spam
> >through. Shell into your box and do a locate FormMail. Also, try
> >digging
> >around the Apache logs for signs of FormMail.
> >
> >HTH,
> >j
>
> arha.. locate FormMail does produce 2 finds.
> perhaps this is the culprit?
>
> --
> Sean Chester, sean.chester@xxxxxxxxxxxxxx on 16/05/2002

So now go have a look in web.log _not_ mail.log for those virtual sites and
see whats happening.

Phil
(who had the same issue recently.........)

http://www.diygear.com THE Online DIY Toolstore For DIY & Business
Infolink Electronic Systems Ltd. Suppliers of:- PC based Computer Systems,
Peripheral & Hardware, Plus Web Design & Cobalt Raq4 Hosting Solutions
Contact the Sales desk at  infolink@xxxxxxxxxxxxxxx or Tel 0121 458 4894
(office) 0121 441 3558 (home)